Cloudflare Wrangler "Authentication error [code: 10000]" in CI

By Daniel Zoghalchali·Latchkey

Cloudflare returns error 10000 when the credentials Wrangler sent are not valid for the request. In CI this usually means CLOUDFLARE_API_TOKEN is unset, wrong, or does not have the scopes the command needs.

What this error means

A wrangler deploy step fails with "A request to the Cloudflare API ... failed. Authentication error [code: 10000]".

A request to the Cloudflare API (/accounts/.../workers/scripts/...) failed.
Authentication error [code: 10000]

Common causes

Missing or invalid API token

Wrangler found no CLOUDFLARE_API_TOKEN, or the token is wrong or revoked, so Cloudflare rejects the call with 10000.

The token lacks the required scope

The token authenticates but does not have the Workers/Pages edit permission the command needs, which Cloudflare also reports as 10000.

How to fix it

Provide a scoped API token

1. Create an API token in Cloudflare with the Workers Scripts Edit (or Pages Edit) permission.
2. Store it as a CI secret named CLOUDFLARE_API_TOKEN.
3. Set CLOUDFLARE_ACCOUNT_ID and expose both to the Wrangler step.

env:
  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
  CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}

Verify the token permissions

A persistent 10000 after setting the token means the scope is wrong; recreate the token with the exact edit permission for the resource you deploy.

How to prevent it

• Use a least-privilege API token with the exact edit scope.
• Keep CLOUDFLARE_API_TOKEN in CI secrets.
• Set CLOUDFLARE_ACCOUNT_ID so Wrangler targets the right account.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation